Back to results
US 12,756,728 B2Granted
Detection of cryptocurrency mining traffic
AssigneeMellanox Technologies, Ltd.
InventorsVadim Gechman, Haim Elisha, Nir Rosen, Chen Rozenbaum, Ahmad Saleh, Muhammad Abu Saleh, Emil Khshiboun
Life of this patent
Estimating the term…
Abstract
A system and method may detect crypto mining, including using a processor: obtaining a stream of packets; extracting metadata of the packets; and determining whether the packets are related to crypto mining by providing the metadata of the packets to a machine learning (ML) model.
Claims20
A method for blocking streams related to crypto mining, the method comprising, using a processor:
- obtaining a plurality of packets from a plurality of clients;
- extracting metadata of the packets, wherein, for each of the packets, the metadata is selected from the list consisting of:
- source Internet protocol (IP) address and port, destination IP address and port, packet size, packet direction, a timestamp, and at least one Transmission Control Protocol (TCP) flag of the packet;
- organizing the metadata of the plurality of packets in queues based on the metadata, wherein each queue comprises metadata of packets of a single stream, wherein the packets in each queue are organized in consecutive order based on the timestamp of the packets included in the metadata;
- for each queue, operating a machine learning (ML) model, which has been trained to detect patterns related to crypto mining activity, on the metadata of consecutive packets in the queue to determine whether the packets are related to crypto mining;
- and
- blocking streams that are determined as related to crypto mining.
4 more elements
A method for blocking flows related to crypto mining activity in a computer network, the method comprising:
- mirroring a plurality of packets flowing in the computer network from a plurality of clients;
- extracting features of each of the plurality of packets, wherein, for each of the packets, the metadata is selected from the list consisting of:
- source Internet protocol (IP) address and port, destination IP address and port, packet size, packet direction, a timestamp, and at least one Transmission Control Protocol (TCP) flag of the packet;
- organizing the features of the plurality of packets in flows based on the features wherein each flow comprises features of packets of a single stream, wherein the packets in each queue are organized in consecutive order based on the timestamp of the packets included in the metadata;
- and
- for each flow, operating a machine learning (ML) model, which has been trained to detect patterns related to crypto mining activity, on the features of consecutive packets in the flow to detect the crypto mining activity;
- and
- blocking flows that are detected as related to crypto mining.
5 more elements
A system for blocking streams related to crypto mining, the system comprising:
- a memory;
- and
- a processor configured to:
- obtain a plurality of packets from a plurality of clients;
- extract metadata of the packets, wherein, for each of the packets, the metadata is selected from the list consisting of:
- source Internet protocol (IP) address and port, destination IP address and port, packet size, packet direction, and at least one Transmission Control Protocol (TCP) flag of the packet;
- organize the metadata of the plurality of packets in queues based on the metadata, wherein each queue comprises metadata of packets of a single stream, wherein the packets in each queue are organized in consecutive order based on the timestamp of the packets included in the metadata;
- for each queue, operate a machine learning (ML) model, which has been trained to detect patterns related to crypto mining activity, on the metadata of consecutive packets in the queue to determine whether the packets are related to crypto mining;
- and
- block streams that are determined as related to crypto mining.
7 more elements
Dependencies are inferred from the claim text.